c6b1629c385c20d289190ef0717a66789cbbd666e9c8eb7231f0fdfd542339ab

Sharing

Copy URL Twitter E-mail

General

Target
ptnyls.zip
Size 73.0MB
Sample260707-yn2tfsdy9k
SHA256 c6b1629c385c20d289190ef0717a66789cbbd666e9c8eb7231f0fdfd542339ab
MD5 cf93aff238bfac45884bf6c827b51e15
SHA1 e7cae0f051099a8b4e3d15c01f693912193a2e82
SHA512 6008aaad4050f900b47cd9064d09f6c28694ab1c920182771c0fe4222feb87858eca99abc99f960446e4c6f7613ff03771724ff9aa13136b896cd928c4622e11
SSDEEP 1572864:XH3lLZCRIHFfQwMmNlogYjZ7UE64RRl6WoBuSw8ZB2WSlpiKTtIHy5mHe6:XH1FCRIlRpNaR606WSfJKTtIHy5m+6
TLSH
T105F7334DCAF36599CD3BC732DDDA228D123E81D744E3E4578818A264A4ECC71DA88D6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ptnyls.zip
- Size 73.0MB
- SHA256 c6b1629c385c20d289190ef0717a66789cbbd666e9c8eb7231f0fdfd542339ab
- MD5 cf93aff238bfac45884bf6c827b51e15
- SHA1 e7cae0f051099a8b4e3d15c01f693912193a2e82
- SHA512 6008aaad4050f900b47cd9064d09f6c28694ab1c920182771c0fe4222feb87858eca99abc99f960446e4c6f7613ff03771724ff9aa13136b896cd928c4622e11
- SSDEEP 1572864:XH3lLZCRIHFfQwMmNlogYjZ7UE64RRl6WoBuSw8ZB2WSlpiKTtIHy5mHe6:XH1FCRIlRpNaR606WSfJKTtIHy5m+6
- TLSH
  T105F7334DCAF36599CD3BC732DDDA228D123E81D744E3E4578818A264A4ECC71DA88D6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  wow xavier is hella amazing x_x/Misty.exe
- Size 4.9MB
- SHA256 3202bce3607a5a726fd66162eb51d9d2d9015c387d13fd31a8b95000b02db367
- MD5 2d9a2217b5aa58c9448e1c790f49d381
- SHA1 ba9fc0c1fd8ab9dbfd31ea827e91718a3dd1afbc
- SHA512 8b1ec26d8445cd9e7cf2169320145b6d5dfb1d86f01b4f94c4c3a1d5e9688f3fbc4c9f466f0ded31806a8f8c1190728c3660499f73f5f115fa5a891b47157e38
- SSDEEP 98304:Vd/aLHSZKZ2o/Y7mgTm05AwJHE6h+g5lZqL9PlF:uje4ng7PAmktEZqL1lF
- TLSH
  T1FC36BE42B3A1C5A9C2668138CA52D7A7D7323C080F2157EB369C7E1E6F736E04E7A751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  wow xavier is hella amazing x_x/Misty.pdb
- Size 21.2MB
- SHA256 b0eb9b5b6a4d8130345e83d4337c82af3c0754005f0548e64ea2b9d3f0b93eb0
- MD5 dd58eeb0f1c0483aeb227f1a8146ba62
- SHA1 484296226de1fb204f071a3b3d640f99cce55fae
- SHA512 a81a189d491830247695f73d57671bf55b1874081986e51265ad4d9edcf09f9514d089abdaea60be93ae597a572e14b398187a639d53f14fb8c6955fd5996e46
- SSDEEP 98304:tWYRKm+IsuVQloPegbsFBlbmnVnXn4nJZp4npxGxzv4owK:XRKm+IsKnVnXn4nJ4npxGxzv4b
- TLSH
  T14C274A52B2958D13C8AF2779E197172C73A59802BFCE2B87484FA2184DD634CDF9BD81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  wow xavier is hella amazing x_x/anti/Misty.exe.recipe
- Size 301B
- SHA256 68d1a11b93911be6ad97bae83af1202053a00fb4e22e20704a0d0e2b7f662f08
- MD5 9396ac3d0743228027f872ae67caf5f8
- SHA1 28dd7bf3243d221d17964d8548594fcb157af3c3
- SHA512 7ae6c41531b918468e1c4f8d4affc07a422cbd3d08634cfbebf5b91c832030f51aeedd8df61501915413b2edafe2263c474aab7989a6ae56fbeb26e11f7aa5b3
- TLSH
  T15BE0C26E48C4F142A7F03111A23D8FAEFB1BAED309300CA03080CD7F0E5300808434AB
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  wow xavier is hella amazing x_x/anti/Misty.iobj
- Size 37.2MB
- SHA256 c7c34f8d2ac5178743a299107ce0c2663ec956ef0190e9f76b05874daf32231c
- MD5 20856aff51424036d9b6c232704e5b1b
- SHA1 f480da11eaacf0d24d7798faca05642c03f81c2d
- SHA512 731c6f2e836bcae2b19d2ccd609042369cfbb51fa42ccb1d711876cc1af8f206c9e59d416a1bd2021cf23d861140896e37f1a2499bf0284f1713d47e8682f49a
- SSDEEP 196608:ohzd8g7PAmkbPZqy14FDRzNxWk+M/1V2uhA8b1T85HLZWih:o5XPAmkbMy1oRz2T8CWq
- TLSH
  T12A870905A26DC663DA6B33B4E5D3052DB371BC43BB46B30361DBA1255E9338CAF9B490
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  wow xavier is hella amazing x_x/anti/Misty.ipdb
- Size 13.5MB
- SHA256 4dfd781354ad9025198f352485a1c901017f4cf048e7fd39909d4cbe541f08d3
- MD5 3b8e67065c9385fe0b847d159ebe4681
- SHA1 645102925fc20eae86314c1b3e20dfe74fefc371
- SHA512 77ca394e5e85fcf6ba173a2f05e4d7b34539c52ebc5d95a99840f45213ad5a6be2af16048e906f497ceff69a6b443caebf2d807f4d9ad471b8976e8f039d603f
- SSDEEP 24576:Nt1mWuNmLu2ItekkkxximHXVI78AwmEOpAXZSujyI5vPCd/al9wlMAeDdmNM0+:NrTSKkPHzALExXZR36C9XA
- TLSH
  T11CE64145730A97B3C85A237158D76B627730ED429F0BA74760FAE12D1FA33887BA3590
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  wow xavier is hella amazing x_x/anti/Misty.tlog/CL.command.1.tlog
- Size 146KB
- SHA256 0571b3d6977a0cbda8e6b4081f3bee777cd900d4eb849154f6d518fb690a7c37
- MD5 1e34f687fcf8bc642eab276832c53408
- SHA1 3ebf46d6c0709728733250da52a18e8d4b10737e
- SHA512 1802666265d90c312080cee0f1bd3e2356901256e91c95197b0d014e4ac0094cc04d66fc3ae80bff25cf032a66cda2569977028a766565028bb18f7a1e09851a
- SSDEEP 384:R2G7dhXdRgdD6UxurrWa6eMAR7u+SYTju7rIkUEL7r7/TRrrTDnMkJsk2br7zuwo:I
- TLSH
  T1B4E3A22035EDA14AA3A536CE5FEBC49BCFBAF3B58933416F1170410B1395E08AE15B76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  wow xavier is hella amazing x_x/anti/Misty.tlog/CL.read.1.tlog
- Size 3.2MB
- SHA256 be628b3679d44fbc34388832bd7320c2170009cc34e92ba5df8d32c8b1dd6349
- MD5 af8f1024b9289e62c4e229640ce885c8
- SHA1 92ca875f381f7e31950ce7939225d587ff7d32ce
- SHA512 c8e3088e8893fcd3f4d4edff5fa1660838e4767e8853599b19e6838e74b2b49d960db3c1e94aea8f87e1fcf8b3f2178c843e3543dac876d96876a6c6609deea8
- SSDEEP 1536:qj4vFjrvkjCjWv7v7vUjIu/HvcjAvkjLjcvIjAu/SvJjRvdvdjtvkjmjuvhc6jVO:JeGXBPd
- TLSH
  T1BEF52C1D70EA22496316F1C69BCE965BC727F2F8C63B172F51D413031390A176A86FAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  wow xavier is hella amazing x_x/anti/Misty.tlog/CL.write.1.tlog
- Size 42KB
- SHA256 50f5523a0b2355aa7ba95966963659f1a2195ce690c22870224226207e40585d
- MD5 ca7222f99d0751b69f47a8d1e2160618
- SHA1 0a96570985cbfad15d7bcb81268fc819332eafc8
- SHA512 532e1adfb45c38f2c4a403bd26e7845f8714c9577a568f5ba9efd78daff9a28210865975e96a37133ca0546d1ff9e0e949e0062beff02a34a2f415958fcc418a
- SSDEEP 192:3gtnAhuzGGI1KdRoxBYcKjmRbynGhYIdzSKcozgwx:3gfqgRoxeMbnQozgwx
- TLSH
  T1BE13E02138EDB29AA75930DA5FDAC4ABCF1BE2B1C667123B6076400727C5E0D170D7B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  wow xavier is hella amazing x_x/anti/Misty.tlog/Cl.items.tlog
- Size 10KB
- SHA256 47203594db5c38b7c135cabd7efa73fb1d50276e052bb11b9c1a37338abc4307
- MD5 816c9d17bfa4824cad8f1d9aea1bff0b
- SHA1 4748b285bc21c50ea280c8bfaf7985a2ff06b0d4
- SHA512 e2489fdadb2b0c44f9c5442ee1c222b32e04948d950d75da0e1f49e370d7fd9d1518a13f72147ee9ca7aa9a286520a4dbb93a5f9c1a2df00ed78c7dfb18b5193
- SSDEEP 192:oCI081TkvUr6cUjYODH8/TKofzDWCIvPkNF0dXFMKq9WgtchGOqBm1Bk8akwBTZJ:oCG1TkvUr6cUjYOT8/TKofzDWCIvPkNx
- TLSH
  T19E32776F107AD07E84A138039B34CFDD9DE4898BA93195FAF7A08917D41887ABDE111F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  wow xavier is hella amazing x_x/anti/Misty.tlog/Masm.read.1u.tlog
- Size 144B
- SHA256 fbb1279748fceae6c9b8d8ab2b82b50284a08e10d53aab5fff1d74c49bd4f32b
- MD5 aa10f3a7bba9e08c71f1a9ab6fd68e29
- SHA1 9c5214f8a3159c31b67f9bb3d80ceb990cb5c3d4
- SHA512 7232b8ff3f872e41f4988ee75113c86caa530b3514da403be697ec9fe11307ab7c05364b6f0bf126b22bc0d667def7ca80509adf582e3586fb2b7264ec868100
- TLSH
  T1DCC0922830D972866B2870DA4BC9C81ACF1BD171C816012B6031800226C5D0C160C265
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  wow xavier is hella amazing x_x/anti/Misty.tlog/Masm.write.1u.tlog
- Size 272B
- SHA256 b1364daea5e1290e498308af4845a3a328038900b72b95df6e155fa50bcb1a42
- MD5 7c3cfac5b7abf61f56cc40c405ef6155
- SHA1 2884138bf882f79207ba404a5b79b3bb5cfa1f44
- SHA512 2e518c908acda8a1fcf10f31fbbb2c66c4770bcd37c489261cc1cb00dc02ae9eaf9d5fc7ba57e62d040796b3ac100488150e81864cd29e1fd291a533dab54b3a
- TLSH
  T174D0C93434EDB286676C30DA4BC9C42ECF1BE171C927113F7035810227C5D0C170C2A6
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  wow xavier is hella amazing x_x/anti/Misty.tlog/Misty.lastbuildstate
- Size 174B
- SHA256 3c42d320f1114795ab9eee5bcc79263068c03a8253edbfbd65d1edc79442d64e
- MD5 a4aa922ec23dbb48ee37e490f2e1dfa2
- SHA1 e532c78373d81186ecdf2baa179450821d659fe1
- SHA512 2ec92019db560534146f45b5073680aae778cb50ad7ae7e1676efff19684f93e26921394476b837f5dd9e0b5ca41f976c4c4ead55458f12bc90fbd8428f332b2
- TLSH
  T1F6C0C00C0314D2F2A421780790D0018D53F892526931B08CAE50170E9F49018009323F
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  wow xavier is hella amazing x_x/anti/Misty.tlog/link.command.1.tlog
- Size 40KB
- SHA256 d9f20d95852a7e414b220ca93b9da76190f5be4d58b8b73b62545406fb9480d3
- MD5 43b6085d7443155657f7957c1ba72684
- SHA1 baa78a184567904e9231e3d17bdae6f3c9396e6a
- SHA512 b3ca47f4b2e15b33916378fbe9976fadcae5f0785ae42df602c3c12cb8cabf383f8a6441b9de368effa4fc5b2aec3ccbeef3be901a086f53613c84a928c97c05
- SSDEEP 384:WQkh+mVMlREDV8YX7IPaf/AeSo9AFoARBLviO/o5hDkoL9nWFbDOPRDbU2Qc6+h/:uHMCp
- TLSH
  T1D513F77034EEB58A539530D65FEEC47ECB17F3BA8917623F2461810B67C2D0A1B096B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  wow xavier is hella amazing x_x/anti/Misty.tlog/link.read.1.tlog
- Size 26KB
- SHA256 5f36dc9d8d1e2d27a255a9027366b885e9137f681551c22c8d2191d6d854f976
- MD5 e9719e054884d4c14b58ba48159e4fa0
- SHA1 8f243ad475a312b4bd5baf635986fd05ae85d58b
- SHA512 77d33bac339ddef5f23bfa5d94d3671e6cd8ca18a84a94991907cdb5c5e01407acbef45e46f51b5b76b70320e9694a96fa79c373eac03130733ffbeacee7a73c
- SSDEEP 384:sienEMz2D3O1Dmah9a5oJ5yEQKryjaSX3d5Ak5Kv3Vu69bRsDtDkZHF9uciG4EnA:U8
- TLSH
  T142C2FB3034EDB68A679970CA5FDAD47BCB17B2B08A27123F6175420767C2D0E1B097B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  wow xavier is hella amazing x_x/anti/Misty.tlog/link.secondary.1.tlog
- Size 5KB
- SHA256 7e5189ff4b51413bd9421f42ce61da77d4aba5dc03c31b8be956a5e78f9fa8fa
- MD5 cedd8541e15720586a6b4f8a25a929c5
- SHA1 713f6522d6d3a281405fe52bdbebc99963882239
- SHA512 4fd0f049de16cf9c033672821230446e9d192f28c8548ae92b86b8c77ab46c3cc28126782d68b0fff4eba81de9a40a5321f9180aedfb65cfb82fdd6ecee9f4ae
- SSDEEP 96:NcMIjeWZXZOZFvgBrjw6HTYlQTBcC44dCNacRLNXWWAeAJLqmfeIdHj8tV4Lp/Tf:Kpa1eICONO
- TLSH
  T107B1780A424EF65E2F4D3C0A7574ADDD8FD0B856A63A144E31386E24DCDF708DAE711A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32